Azure AD Graph api返回Forbidden

Question

当我想从我的应用程序graph.windows.net/{aadDirectoryId}/users/{userId.Value}/$links/memberOf?api-version=1.6从图api中获取成员时

我总是得到

Response: StatusCode: 403, ReasonPhrase: 'Forbidden', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
  Pragma: no-cache
  ocp-aad-diagnostics-server-name: aVvd1R49Sg=
  request-id: 67105ddc-2b5f-84bf-7ec43a4d3117
  client-request-id: fb1ef66f-451357f08975abd4
  x-ms-dirapi-data-contract-version: 1.6
  ocp-aad-session-key: _XjEM7ooA1Emw_l6FjiyMwKqtoEPSWgxw-04c_nX785foVv6fGM_lBejApG_gJW2fXC_LBNrZRJRryuBIOO7_O1bF2oEEiWMvnW9Ywx71OP0NJ5gRyZDGlLyNsjmsDvu.42WXAH4v8FjbaSNvNtH1Nnkm3z5on0J5ZsptMguA52A
  DataServiceVersion: 3.0;
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Access-Control-Allow-Origin: *
  Duration: 853533
  Cache-Control: no-cache
  Date: Tue, 05 Mar 2019 14:01:17 GMT
  Server: Microsoft-IIS/10.0
  X-AspNet-Version: 4.0.30319
  X-Powered-By: ASP.NET
  Content-Length: 219
  Content-Type: application/json; odata=minimalmetadata; streaming=true; charset=utf-8
  Expires: -1
} 

当我打电话给https://graphexplorer.azurewebsites.net/时，一切都很好。

在azure AD中，我为api permission设置了权限

通话代码：

private static List<string> GetGroupsFromGraphAPI(ClaimsIdentity claimsIdentity)
        {
            _logger.Info($"Getting claims from Graph API for {claimsIdentity.Name}.");

            List<string> groupObjectIds = new List<string>();

            var aadClientId = ConfigurationManager.AppSettings["ida:ClientId"];
            var aadSecret = ConfigurationManager.AppSettings["ida:ClientSecret"];
            var aadDirectoryId = ConfigurationManager.AppSettings["ida:DirectoryId"];

            ClientCredential credential = new ClientCredential(aadClientId, aadSecret);
            AuthenticationContext authContext = new AuthenticationContext("https://login.microsoftonline.com/" + aadDirectoryId);
            string accessToken;
            try
            {
                _logger.Info($"Client ID: {aadClientId}");
                _logger.Info($"Secret: {aadSecret}");
                _logger.Info($"Directory id: {aadDirectoryId}");

                var token = authContext.AcquireToken("https://graph.windows.net", credential);
                _logger.Info($"Token: {token.ToString()}");
                accessToken = token.AccessToken;
                _logger.Info($"Get access token {accessToken}");
            }
            catch
            {
                _logger.Error("Cannot aquire token for Graph API.");
                throw;
            }

            var userId = claimsIdentity.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier");
            if (userId == null)
            {
                _logger.Warn($"No user ID to get group membership for. ({claimsIdentity.Name})");
                return groupObjectIds;
            }

            HttpClient client = new HttpClient();
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
            HttpResponseMessage response;
            try
            {
                var link =
                    $"https://graph.windows.net/{aadDirectoryId}/users/{userId.Value}/$links/memberOf?api-version=1.6";
                _logger.Info($"GetAsync {link}");
                response = client.GetAsync(link).Result;
            }
            catch
            {
                _logger.Error("Failed to load group membership for " + claimsIdentity.Name);
                throw;
            }
}

Answer 1

1. 推理Forbidden错误和需要管理员同意 查看已共享以获取令牌的代码，您正在使用应用程序标识，因此应用程序所需的权限将是应用程序权限。

       ClientCredential credential = new ClientCredential(aadClientId, aadSecret);
       AuthenticationContext authContext = new AuthenticationContext("https://login.microsoftonline.com/" + aadDirectoryId);  
       ...
       var token = authContext.AcquireToken("https://graph.windows.net", credential);

   在屏幕截图中，您已选择了Azure AD图表的Directory.Read.All权限，但它也表示管理员同意未完成。如果您查看权限，它会清楚地说明，管理员同意是否为是。 因此，您的解决方案是授予管理员同意以获得所需的许可。如果您以管理员身份登录，则可以直接从Azure门户（您已分配权限的同一页面）执行此操作。另一种方法是使用AdminConsent Endpoint
2. 为什么它适用于你https://graphexplorer.azurewebsites.net/ Azure AD Graph Explorer正在使用Delegated Permissions并以登录的用户身份调用API，因此它正在为您工作。虽然您尝试从应用程序中执行相同的操作，但不同之处在于您使用应用程序的身份进行调用，但尚未同意权限。
3. 在API权限下，只需要Azure AD Graph API 在您共享的代码中，您只调用https://graph.windows.net，因此您的应用程序只需要Azure AD Graph API的权限。您可以安全地删除为Microsoft Graph API分配的权限（除非您在应用程序的其他位置使用Microsoft Graph API）